[codex] Fix server handler payload aliases

[bokelley]

Summary

• Add named server *Payload and *HandlerResult aliases across decisioning surfaces and re-export them from @adcp/sdk/server.
• Keep server payload annotations response-safe by stripping protocol envelope fields plus write-only webhook credentials and billing bank coordinates.
• Align raw response builders with the public payload types by stripping nested account credentials/bank fields and media-buy invoice-recipient bank fields at runtime.
• Expand repo and packed-adopter type guards for Result<Payload, E>, TaskHandoff, account handler aliases, broad alias exports, and write-only field stripping.

Root Cause

The previous tests covered direct SalesPlatform payload returns, but not adopter helper layers that annotate results as Result<GeneratedWireResponse, E>. Those generated response types include protocol task-envelope fields such as status: TaskStatus, so adopter helpers were forced to return envelope fields that the SDK owns and stamps later.

During expert review, we also found that widening public payload aliases needed to stay aligned with the write-only response contract for nested webhook credentials and bank details. This PR fixes both the type surface and the raw response-builder runtime projection.

Expert Review

• Protocol review flagged the raw response-builder runtime/type mismatch for nested account credentials and bank fields; fixed with runtime stripping and regression tests.
• Security review flagged write-only authentication.credentials and BusinessEntity.bank exposure risk in public aliases; fixed in ServerPayload<T> and guarded by type tests.
• Code review flagged no remaining blockers after the runtime/type fixes.
• Product review asked for broader alias coverage, account handler alias guards, and migration guidance; all added.

Validation

• npm run typecheck
• npm run build:lib
• node --test test/server-responses.test.js test/lib/account-notification-config-projection.test.js
• npm run check:adopter-types
• git diff --check
• Pre-push hook: typecheck + build:lib

Fixes #1988